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IN THE CLAIMS : 

Please amend the claims as follows: 

1. (Currently Amended) A method for detecting abnormal activity of a 
server application user, the method comprising: 

(a) measuring a predetermined activity of a server application user over a 
first predetermined time for generating a first measurement; 

(b) measuring the predetermined activity of the server application user over 
a second predetermined time for generating a second measurement; 
and 

(c) determining whether the first and second measurements deviate a 
predetermined amount to detect abnormal activity for the server 
application user^ 

wherein the predetermined activity comprises web page requests . 

2. (Original) The method of claim 1, comprising maintaining a log of the 
predetermined activity of the server application user over the first and second 
predetermined times. 

3. (Original) The method of claim 1, wherein the predetermined activity 
comprises a server application request. 

4. (Currently Amended) Th e m e thod of c l a i m 3, A method for detecting 
abnormal activity of a server application user, the method comprising: 

(a) measuring a predetermined activity of a server application user over a 
first predetermined time for generating a first measurement: 

(b) measuring the predetermined activity of the server application user over 
a second predetermined time for generating a second measurement: 
and 
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(c) determining whether the first and second measurements deviate a 
predetermined amount to detect abnormal activity for the server 
application user. 

wherein the predetermined activity comprises a server application request, 
and 

wherein the server application request is [[an]] a hypertext transfer protocol 
(HTTP) request. 

5. (Original) The method of claim 1, wherein the predetermined activity 
comprises failed login attempts. 

6. (Original) The method of claim 1 , wherein the predetermined activity 
comprises login time. 

7. (Canceled) 

8. (Currently Amended) The method of claim [[3]] 1, wherein the web page 
requests are hypertext transfer protocol (HTTP) requests. 

9. (Currently Amended) The method of claim [[7]] 1, wherein the second 
measurement is an average count of web page requests for communication sessionsi 
between the server application user and a server application. 

10. (Currently Amended) The method of claim [[7]J 1, wherein the second 
measurement is an average count of web page requests between the server 
application user and a server application during a time interval. 

1 1 . (Currently Amended) Th e m e thod of c l aim 1 , A method for detecting 
abnormal activity of a server application user, the method comprising: 
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(a) 


measuring a predetermined activitv of a server aoDlication user over a 




first Dredetermined time for aeneratina a first measurement: 


(b) 


measurina the predetermined activitv of the server aoDlication user over 




a second predetermined time for aeneratina a second measurement: 




and 


(c) 


determinina whether the first and second measurements deviate a 


Dredetermined amount to detect abnormal activity for the server 



application user 

wherein the predetermined activity comprises failed web page requests. 

12. (Original) The method of claim 11, wherein the second measurement is 
an average count of failed web page requests for communication sessions between 
the server application user and a server application. 

13. (Original) The method of claim 1, wherein the predetermined activity 
comprises session duration. 

14. (Currently Amended) A system for detecting abnormal activity of a 
server application user, the system comprising: 

(a) a network interface for receiving communication data of a 
predetermined activity of a server application user over a first and 
second predetermined time, respectively; and 

(b) a detector operable to generate a first and second measurement of the 
predetermined activity for the first and second predetermined times, 
respectively, and operable to determine whether the first and second 
measurements deviate a predetemnined amount to detect abnormal 
activity for the server application user^ 

wherein the predetermined activitv comprises web page requests . 
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15. (Original) The system of claim 14, comprising a log operable to 
maintain a record of the predetermined activity of the server application user over the 
first and second predetermined times. 

16. (Original) The system of claim 14, wherein the predetemiined activity 
comprises a server application request. 

17. (Currently Amended) Tho system of c l a i m 16, A system for detecting 
abnormal activity of a server application user, the system comprising: 

(a) a network interface for receiving communication data of a 
predetermined activity of a server application user over a first and 
second predetermined time, respectively: and 

(b) a detector operable to generate a first and second measurement of the 
predetermined activity for the first and second predetermined times, 
respectively, and operable to determine whether the first and second 
measurements deviate a predetermined amount to detect abnormal 
activity for the server application user. 

wherein the predetermined activity comprises a server application reouest. 
and 

wherein the server application request is [[an]] a hypertext transfer protocol 
(HTTP) request. 

18. (Original) The system of claim 14, wherein the predetermined activity 
comprises failed login attempts. 

19. (Original) The system of claim 14, wherein the predetemiined activity 
comprises login fime. 

20. (Canceled) 
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21. (Currently Amended) The system of claim [[20]] 14, wherein the web 
page requests are hypertext transfer protocol (HTTP) requests. 

22. (Currently Amended) The system of claim [[20]] 14, wherein the second 
measurement is an average count of web page requests for communication sessions 
between the server application user and a server application. 

23. (Currently Amended) The system of claim [[20]] 14, wherein the second 
measurement is an average count of web page requests between the server 
application user and a server application during a time interval. 

24. (Original) The system of claim 14, wherein the predetermined activity 
comprises failed web page requests. 

25. (Original) The system of claim 24, wherein the second measurement is 
an average count of failed web page requests for communication sessions between 
the server application user and a server application. 

26. (Original) The system of claim 14, wherein the predetermined activity 
comprises session duration. 

27. (Currently Amended) A computer program product comprising 
computer-executable instructions embodied in a computer-readable medium for 
performing steps comprising: 

(a) measuring a predetermined activity of a server application user over a 
first predetermined time for generating a first measurement; 

(b) measuring the predetermined activity of the server application user over 
a second predetermined time for generating a second measurement; 
and 
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(c) determining whether the first and second measurements deviate a 
predetermined amount to detect abnormal activity for the server 
application user^ 

wherein the predetermined activity comprises web page requests . 

28. (Original) The computer program product of claim 27, comprising 
maintaining a log of the predetermined activity of the server application user over the 
first and second predetermined times. 

29. (Currently Amended) The computer program product of claim [[14]] 27, 
wherein the predetermined activity comprises a server application request. 

30. (Currently Amended) The computer program product of claim 20, A 
computer program product comprising computer-executable instructions embodied in 
a computer-readable medium for performing steps comprising: 



(a) 


measuring a predetermined activitv of a server application user over a 




first predetermined time for generating a first measurement: 


(b) 


measuring the predetermined activitv of the server application user over 




a second predetennined time for generating a second measurement: 




and 


(c) 


determining whether the first and second measurements deviate a 




predetermined amount to detect abnormal activitv for the server 




application user. 


wherein the predetermined activitv comprises a server application reguest. 


and 



wherein the server application request is [[an]] a hypertext transfer protocol 
(HTTP) request. 



31. (Original) The computer program product of claim 27, wherein the 
predetermined activity comprises failed login attempts. 
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32. (Original) The computer program product of claim 27, wherein the 
predetermined activity comprises login time. 

33. (Canceled) 

34. (Currently Amended) The computer program product of claim [[33]] 27, 
wherein the web page requests are hypertext transfer protocol (HTTP) requests. 

35. (Currently Amended) The computer program product of claim [[33]] 27, 
wherein the second measurement is an average count of web page requests for 
communication sessions between the server application user and a server 
application. 

36. (Currently Amended) The computer program product of claim [[33]] 27, 
wherein the second measurement is an average count of web page requests 
between the server application user and a server application during a time interval. 

37. (Original) The computer program product of claim 27, wherein the 
predetermined activity comprises failed web page requests. 

38. (Original) The computer program product of claim 37, wherein the 
second measurement is an average count of failed web page requests for 
communication sessions between the server application user and a server 
application. 

39. (Original) The computer program product of claim 27, wherein the 
predetermined activity comprises session duration. 
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40. (Currently Amended) A method for detecting abnormal activity of a 
server application user, the method comprising: 

(a) measuring a predetermined activity of a plurality of server application 
users over a first predetermined time for generating a first 
measurement; 

(b) measuring the predetermined activity of a first server application user 
over a second predetemiined time for generating a second 
measurement; and 

(c) determining whether the first and second measurements deviate a 
predetermined amount to detect abnormal activity for the first server 
application user^ 

wherein the predetermined activity comprises web page requests . 

41. (Original) The method of claim 40, comprising maintaining a log of the 
predetermined activity over the first and second predetermined times. 

42. (Canceled) 

43. (Currently Amended) The method of claim [[42]] 40, wherein the web 
page requests are hypertext transfer protocol (HTTP) requests. 

44. (Original) The method of claim 40, wherein the second measurement is 
average count of web page requests for communication sessions between the server 
application user and a plurality of server applications. 

45. (Original) The method of claim 40, wherein the predetermined activity 
comprises session duration. 
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46. (Original) The method of claim 40, wherein the second measurement is 
average session duration for communication sessions between the server application 
user and a plurality of server applications. 

47. (Currently Amended) A system for detecting abnormal activity of a 
server application user, the system comprising: 

(a) a network interface for receiving communication data of a 
predetermined activity of a first server application user and a seJected 
plurality of server application users over a first and second 
predetermined time, respectively; and 

(b) a detector operable to generate a first and second measurement of the 
predetemriined activity for the first and second predetermined times, 
respectively, and operable to determine whether the first and second 
measurements deviate a predetermined amount to detect abnormal 
activity for the first server application user^ 

wherein the predetermined activitv comprises web page requests . 

48. (Original) The system of claim 47, comprising a log for recording the 
predetermined activity over the first and second predetermined times. 

49. (Canceled) 

50. (Currently Amended) The system of claim [[49]] 47, wherein the web 
page requests are hypertext transfer protocol (HTTP) requests. 

51 . (Currently Amended) The system of claim [[49]] 47, wherein the second 
measurement is average count of web page requests for communication sessions 
between the server application user and a plurality of server applications. 
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52. (Original) The system of claim 47, wherein the predetermined activity 
comprises session duration. 

53. (Original) The system of claim 47, wherein the second measurement is 
average session duration for communication sessions between the server application 
user and a plurality of server applications. 

54. (Currently Amended) A computer program product comprising 
computer-executable instructions embodied in a computer-readable medium for 
performing steps comprising: 

(a) measuring a predetermined activity of a plurality of server application 
users over a first predetermined time for generating a first 
measurement; 

(b) measuring the predetermined activity of a first server application user 
over a second predetermined time for generating a second 
measurement; and 

(c) determining whether the first and second measurements deviate a 
predetermined amount to detect abnormal activity for the first server 
application user 

wherein the predetermined activitv comprises web page requests . 

55. (Original) The computer program product of claim 54, comprising 
maintaining a log of the predetermined activity over the first and second 
predetermined times. 

56. (Canceled) 

57. (Currently Amended) The computer program product of claim [[56]] 54. 
wherein the web page requests are hypertext transfer protocol (HTTP) requests. 
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58. (Original) The computer program product of claim 54, wherein the 
second measurement is average count of web page requests for communication 
sessions between the server application user and a plurality of server applications. 

59. (Original) The computer program product of claim 54, wherein the 
predetemiined activity comprises session duration. 

60. (Original) The computer program product of claim 54, wherein the 
second measurement is average session duration for communication sessions 
between the server application user and a plurality of server applications. 
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